Skip to main content

AWS Solutions Library

Overview

This Guidance demonstrates an automated approach for creating the DNS resolution required when creating Amazon VPC Lattice services with custom domain names in multi-account environments. It simplifies the configuration process by automating the Amazon Route 53 DNS setup based on Amazon VPC Lattice service creation and removal actions, eliminating the operational effort of creating resources at scale. You can benefit from a simplified way to connect services across multiple AWS accounts, allowing applications to transparently access the required DNS resolution.

How it works

These technical details feature an architecture diagram to illustrate how to effectively use this solution. The architecture diagram shows the key components and their interactions, providing an overview of the architecture's structure and functionality step-by-step.

Download the architecture diagram

Deploy with confidence

Everything you need to launch this Guidance in your account is right here

We'll walk you through it

Dive deep into the implementation guide for additional customization options and service configurations to tailor to your specific needs.

Open guide

Let's make it happen

Ready to deploy? Review the sample code on GitHub for detailed deployment instructions to deploy as-is or customize to fit your needs. 

Go to sample code

Well-Architected Pillars

The architecture diagram above is an example of a Solution created with Well-Architected best practices in mind. To be fully Well-Architected, you should follow as many Well-Architected best practices as possible.

EventBridge triggers an automated process when a new VPC Lattice service is created. This process invokes a Step Functions state machine to obtain DNS information for the VPC Lattice service and publishes an event to a custom EventBridge event bus. In the DNS-managing AWS account, another Step Functions state machine receives this event through a cross-account event bus and creates the corresponding DNS configuration by adding alias records. This automation eliminates manual DNS configuration for new or deleted VPC Lattice services, reducing operational overhead in multi-account, large-scale environments and enabling transparent DNS resolution for application services.

Read the Operational Excellence whitepaper 

Amazon SQS policies restrict access to specified accounts, organizations, or resources. AWS Identity & Access Management(IAM) roles for Step Functions limit access to relevant resources like EventBridge, Route 53, or VPC Lattice. AWS RAM securely shares resources such as EventBridge event buses only within the same AWS Organization. These measures enforce the principle of least privilege, limiting access to VPC Lattice DNS resolution automation to only the necessary configuration resources and AWS accounts.

Read the Security whitepaper 

The use of managed services like EventBridge, Step Functions, and Amazon SQS minimizes failure risks for continuous event processing without downtime. Specifically, Amazon SQS DLQs in EventBridge targets enable monitoring and retrying of failed message processing. Whereas Step Functions state machines, running serverless, process these events and collect logs for comprehensive visibility.

Read the Reliability whitepaper 

This Guidance uses minimal latency for processing automation across accounts, enabling swift connectivity between a consumer and a newly created VPC Lattice service. In addition, EventBridge provides real-time event processing as a managed service. Moreover, Step Functions and Amazon SQS, both Regional managed serverless services, deliver optimal performance with low operational overhead. This combination of services provides rapid response times and efficient resource utilization in the VPC Lattice DNS resolution automation system, meeting the need for near immediate service availability.

Read the Performance Efficiency whitepaper 

AWS manages the computing resources used in this architecture, following a serverless paradigm. EventBridge, Step Functions, and Amazon SQS operate on-demand, activating only when a new VPC Lattice service is created. This serverless approach ensures compute capacity is used briefly for specific actions, avoiding costs associated with long-running processes. By using these managed services, the VPC Lattice DNS resolution automation system optimizes resource utilization while maintaining high performance and reliability.

Read the Cost Optimization whitepaper 

On-demand computational services and real-time event processing minimize resource usage and environmental impact. For example, EventBridge, Step Functions, and Amazon SQS are fully managed AWS services that operate on an event-driven basis, providing high efficiency and low cost for short-duration tasks. This event-driven architecture in the VPC Lattice DNS resolution automation system contributes to a smaller environmental footprint compared to continuously running processes.

Read the Sustainability whitepaper 

Disclaimer

The sample code; software libraries; command line tools; proofs of concept; templates; or other related technology (including any of the foregoing that are provided by our personnel) is provided to you as AWS Content under the AWS Customer Agreement, or the relevant written agreement between you and AWS (whichever applies). You should not use this AWS Content in your production accounts, or on production or other critical data. You are responsible for testing, securing, and optimizing the AWS Content, such as sample code, as appropriate for production grade use based on your specific quality control practices and standards. Deploying AWS Content may incur AWS charges for creating or using AWS chargeable resources, such as running Amazon EC2 instances or using Amazon S3 storage.